Adding COIN=bitcoin_recovery with all the paths permitted
What the developer wrote
Authored by Ilya Artemov
Adding COIN=bitcoin_recovery with all the paths permitted
What changed, and why it matters
This commit adds a new build variant called 'bitcoin_recovery' to the Ledger Bitcoin app. Unlike the normal Bitcoin app, this variant allows all BIP32 derivation paths and is intended for recovery scenarios. The commit itself does not change runtime code; it only adds a Makefile option to compile a special recovery version of the app. Because it permits all paths, if this variant were loaded onto a device and used normally, it could weaken the usual path-restriction protections, but the commit explicitly frames it as a recovery tool and blocks the dangerous AUTOAPPROVE_FOR_PERF_TESTS flag for this variant.
Treat this as a build-configuration change rather than a direct vulnerability. Review how the 'bitcoin_recovery' variant is distributed, signed, and documented to ensure it cannot be mistaken for or substituted for the standard Bitcoin app. Verify that the empty PATH_APP_LOAD_PARAMS is acceptable for the intended recovery workflow and that the variant is not installable through normal app-store channels without clear warnings.
Security signals we found
New build variant permits all BIP32 derivation paths (PATH_APP_LOAD_PARAMS empty)
Variant is explicitly named 'bitcoin_recovery' and scoped to recovery use cases
Dangerous AUTOAPPROVE_FOR_PERF_TESTS flag is blocked for this variant
No runtime code changes; change is confined to Makefile build options
Permitting all paths reduces the path-isolation guarantee normally enforced by the Bitcoin app
Evidence from the diff
The diff extends VARIANT_VALUES in the Makefile with ‘bitcoin_recovery’ and adds a conditional build block. For this variant, PATH_APP_LOAD_PARAMS is set to the empty string, which on Ledger means all derivation paths are permitted. It sets mainnet Bitcoin constants (BIP32_PUBKEY_VERSION, BIP44_COIN_TYPE=0, P2SH/P2PKH versions, native segwit prefix ‘bc’, coin short id ‘BTC’) and app name ‘Bitcoin Recovery’. It also explicitly forbids compiling with AUTOAPPROVE_FOR_PERF_TESTS for this variant. No C source is modified; only build configuration.
Changed components
Makefile build configurationCOIN variant selectionbitcoin_recovery app variantInspect captured patch +22 / −1
diff --git a/Makefile b/Makefile
index c81f031..e2246b9 100644
--- a/Makefile
+++ b/Makefile
@@ -46,7 +46,7 @@ endif
# Setting to allow building variant applications
VARIANT_PARAM = COIN
-VARIANT_VALUES = bitcoin_testnet bitcoin
+VARIANT_VALUES = bitcoin_testnet bitcoin bitcoin_recovery
# simplify for tests
ifndef COIN
@@ -73,6 +73,7 @@ ifeq ($(COIN),bitcoin_testnet)
DEFINES += COIN_COINID_SHORT=\"TEST\"
APPNAME = "Bitcoin Test"
+
else ifeq ($(COIN),bitcoin)
# Application allowed derivation paths (mainnet).
PATH_APP_LOAD_PARAMS = "*/0'"
@@ -93,6 +94,26 @@ else ifeq ($(COIN),bitcoin)
APPNAME = "Bitcoin"
+else ifeq ($(COIN),bitcoin_recovery)
+ # Application allowed derivation paths (all paths are permitted).
+ PATH_APP_LOAD_PARAMS = ""
+
+ # the version for performance tests automatically approves all requests
+ # there is no reason to ever compile the mainnet app with this flag
+ ifneq ($(AUTOAPPROVE_FOR_PERF_TESTS),0)
+ $(error Use testnet app for performance tests)
+ endif
+
+ # Bitcoin mainnet, no legacy support
+ DEFINES += BIP32_PUBKEY_VERSION=0x0488B21E
+ DEFINES += BIP44_COIN_TYPE=0
+ DEFINES += COIN_P2PKH_VERSION=0
+ DEFINES += COIN_P2SH_VERSION=5
+ DEFINES += COIN_NATIVE_SEGWIT_PREFIX=\"bc\"
+ DEFINES += COIN_COINID_SHORT=\"BTC\"
+
+ APPNAME = "Bitcoin Recovery"
+
else
ifeq ($(filter clean,$(MAKECMDGOALS)),)
$(error Unsupported COIN - use bitcoin_testnet, bitcoin)
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.